PT-2023-26246 · Ibos Oa · Ibos Oa

Funnn7 · Publicado 2023-07-20 · Atualizado 2024-05-17 · CVE-2023-3801

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBOS OA version 4.5.5

Description A critical issue has been found, affecting the function actionEdit of the file ?r=officialdoc/officialdoc/edit in the Mobile Notification Handler component. This issue leads to sql injection. The exploit has been disclosed publicly and may be used. The vendor was contacted about this disclosure but did not respond.

Recommendations For IBOS OA version 4.5.5, as a temporary workaround, consider disabling the actionEdit function of the Mobile Notification Handler component until a patch is available. Restrict access to the file ?r=officialdoc/officialdoc/edit to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-3801

Produtos afetados

Ibos Oa

Referências · 11

• 🔥 https://github.com/Wkingxc/CVE/blob/master/ibos_OA_1.md · Exploit
• 🔥❌ https://github.com/funnn7/cve/blob/main/sql.md · Exploit, Deleted
• https://t.me/cvenotify/54846 · Publicação no Telegram
• https://t.me/cibsecurity/67077 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-3801 · Nota de Segurança
• https://t.me/cvenotify/54928 · Publicação no Telegram
• https://t.me/cvenotify/54803 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-3801 · Aviso do Fabricante
• https://t.me/cvenotify/54935 · Publicação no Telegram
• https://vuldb.com/?id.235069 · Nota
• https://vuldb.com/?ctiid.235069 · Nota